deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Fix issues

Browse Source
This commit is contained in:
Vinay Pamnani 2023-02-28 13:20:28 -05:00
parent 0e79901e8c
commit df59568106
7 changed files with 475 additions and 469 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.openpublishing.redirection.json
View File

@ -20532,7 +20532,7 @@
}, },
{ {
"source_path": "windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md", "source_path": "windows/client-management/mdm/enterprisedesktopappmanagement2-xsd.md",
"redirect_url": "/windows/client-management/mdm/windows/enterprisedesktopappmanagement-csp#downloadinstall-xsd-schema", "redirect_url": "/windows/client-management/mdm/enterprisedesktopappmanagement-csp#downloadinstall-xsd-schema",
"redirect_document_id": true "redirect_document_id": true
}, },
{ {

3
windows/client-management/mdm/assignedaccess-csp.md
View File

@ -324,8 +324,7 @@ This node accepts a ShellLauncherConfiguration xml as input.
<!-- Add any additional information about this policy here. Anything outside this section will get overwritten. --> <!-- Add any additional information about this policy here. Anything outside this section will get overwritten. -->
In **Windows 10, version 1903**, Shell Launcher V2 was introduced to support both UWP and Win32 apps as the custom shell. In **Windows 10, version 1903**, Shell Launcher V2 was introduced to support both UWP and Win32 apps as the custom shell.
- For more information on the schema, see [ShellLauncherConfiguration XSD](#shelllauncherconfiguration-xsd). For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllauncher).
- For more information, see [Shell Launcher](/windows/configuration/kiosk-shelllauncher).
> [!IMPORTANT] > [!IMPORTANT]
> You can't set both ShellLauncher and KioskModeApp at the same time on the device. > You can't set both ShellLauncher and KioskModeApp at the same time on the device.

180
windows/client-management/mdm/defender-csp.md
View File

@ -4,7 +4,7 @@ description: Learn more about the Defender CSP.
author: vinaypamnani-msft author: vinaypamnani-msft
manager: aaroncz manager: aaroncz
ms.author: vinpa ms.author: vinpa
ms.date: 02/17/2023 ms.date: 02/28/2023
ms.localizationpriority: medium ms.localizationpriority: medium
ms.prod: windows-client ms.prod: windows-client
ms.technology: itpro-manage ms.technology: itpro-manage
@ -21,92 +21,90 @@ ms.topic: reference
<!-- Defender-Editable-End --> <!-- Defender-Editable-End -->
<!-- Defender-Tree-Begin --> <!-- Defender-Tree-Begin -->
The following example shows the Defender configuration service provider in tree format. The following list shows the Defender configuration service provider nodes:
```text - ./Device/Vendor/MSFT/Defender
./Device/Vendor/MSFT/Defender - [Configuration](#configuration)
--- Configuration - [AllowDatagramProcessingOnWinServer](#configurationallowdatagramprocessingonwinserver)
------ AllowDatagramProcessingOnWinServer - [AllowNetworkProtectionDownLevel](#configurationallownetworkprotectiondownlevel)
------ AllowNetworkProtectionDownLevel - [AllowNetworkProtectionOnWinServer](#configurationallownetworkprotectiononwinserver)
------ AllowNetworkProtectionOnWinServer - [ASROnlyPerRuleExclusions](#configurationasronlyperruleexclusions)
------ ASROnlyPerRuleExclusions - [DataDuplicationDirectory](#configurationdataduplicationdirectory)
------ DataDuplicationDirectory - [DataDuplicationLocalRetentionPeriod](#configurationdataduplicationlocalretentionperiod)
------ DataDuplicationLocalRetentionPeriod - [DataDuplicationRemoteLocation](#configurationdataduplicationremotelocation)
------ DataDuplicationRemoteLocation - [DefaultEnforcement](#configurationdefaultenforcement)
------ DefaultEnforcement - [DeviceControl](#configurationdevicecontrol)
------ DeviceControl - [PolicyGroups](#configurationdevicecontrolpolicygroups)
--------- PolicyGroups - [{GroupId}](#configurationdevicecontrolpolicygroupsgroupid)
------------ {GroupId} - [GroupData](#configurationdevicecontrolpolicygroupsgroupidgroupdata)
--------------- GroupData - [PolicyRules](#configurationdevicecontrolpolicyrules)
--------- PolicyRules - [{RuleId}](#configurationdevicecontrolpolicyrulesruleid)
------------ {RuleId} - [RuleData](#configurationdevicecontrolpolicyrulesruleidruledata)
--------------- RuleData - [DeviceControlEnabled](#configurationdevicecontrolenabled)
------ DeviceControlEnabled - [DisableCpuThrottleOnIdleScans](#configurationdisablecputhrottleonidlescans)
------ DisableCpuThrottleOnIdleScans - [DisableDnsOverTcpParsing](#configurationdisablednsovertcpparsing)
------ DisableDnsOverTcpParsing - [DisableDnsParsing](#configurationdisablednsparsing)
------ DisableDnsParsing - [DisableFtpParsing](#configurationdisableftpparsing)
------ DisableFtpParsing - [DisableGradualRelease](#configurationdisablegradualrelease)
------ DisableGradualRelease - [DisableHttpParsing](#configurationdisablehttpparsing)
------ DisableHttpParsing - [DisableInboundConnectionFiltering](#configurationdisableinboundconnectionfiltering)
------ DisableInboundConnectionFiltering - [DisableLocalAdminMerge](#configurationdisablelocaladminmerge)
------ DisableLocalAdminMerge - [DisableNetworkProtectionPerfTelemetry](#configurationdisablenetworkprotectionperftelemetry)
------ DisableNetworkProtectionPerfTelemetry - [DisableRdpParsing](#configurationdisablerdpparsing)
------ DisableRdpParsing - [DisableSmtpParsing](#configurationdisablesmtpparsing)
------ DisableSmtpParsing - [DisableSshParsing](#configurationdisablesshparsing)
------ DisableSshParsing - [DisableTlsParsing](#configurationdisabletlsparsing)
------ DisableTlsParsing - [EnableDnsSinkhole](#configurationenablednssinkhole)
------ EnableDnsSinkhole - [EnableFileHashComputation](#configurationenablefilehashcomputation)
------ EnableFileHashComputation - [EngineUpdatesChannel](#configurationengineupdateschannel)
------ EngineUpdatesChannel - [HideExclusionsFromLocalAdmins](#configurationhideexclusionsfromlocaladmins)
------ HideExclusionsFromLocalAdmins - [IntelTDTEnabled](#configurationinteltdtenabled)
------ IntelTDTEnabled - [MeteredConnectionUpdates](#configurationmeteredconnectionupdates)
------ MeteredConnectionUpdates - [PassiveRemediation](#configurationpassiveremediation)
------ PassiveRemediation - [PlatformUpdatesChannel](#configurationplatformupdateschannel)
------ PlatformUpdatesChannel - [RandomizeScheduleTaskTimes](#configurationrandomizescheduletasktimes)
------ RandomizeScheduleTaskTimes - [ScanOnlyIfIdleEnabled](#configurationscanonlyifidleenabled)
------ ScanOnlyIfIdleEnabled - [SchedulerRandomizationTime](#configurationschedulerrandomizationtime)
------ SchedulerRandomizationTime - [SecurityIntelligenceUpdatesChannel](#configurationsecurityintelligenceupdateschannel)
------ SecurityIntelligenceUpdatesChannel - [SupportLogLocation](#configurationsupportloglocation)
------ SupportLogLocation - [TamperProtection](#configurationtamperprotection)
------ TamperProtection - [ThrottleForScheduledScanOnly](#configurationthrottleforscheduledscanonly)
------ ThrottleForScheduledScanOnly - [Detections](#detections)
--- Detections - [{ThreatId}](#detectionsthreatid)
------ {ThreatId} - [Category](#detectionsthreatidcategory)
--------- Category - [CurrentStatus](#detectionsthreatidcurrentstatus)
--------- CurrentStatus - [ExecutionStatus](#detectionsthreatidexecutionstatus)
--------- ExecutionStatus - [InitialDetectionTime](#detectionsthreatidinitialdetectiontime)
--------- InitialDetectionTime - [LastThreatStatusChangeTime](#detectionsthreatidlastthreatstatuschangetime)
--------- LastThreatStatusChangeTime - [Name](#detectionsthreatidname)
--------- Name - [NumberOfDetections](#detectionsthreatidnumberofdetections)
--------- NumberOfDetections - [Severity](#detectionsthreatidseverity)
--------- Severity - [URL](#detectionsthreatidurl)
--------- URL - [Health](#health)
--- Health - [ComputerState](#healthcomputerstate)
------ ComputerState - [DefenderEnabled](#healthdefenderenabled)
------ DefenderEnabled - [DefenderVersion](#healthdefenderversion)
------ DefenderVersion - [EngineVersion](#healthengineversion)
------ EngineVersion - [FullScanOverdue](#healthfullscanoverdue)
------ FullScanOverdue - [FullScanRequired](#healthfullscanrequired)
------ FullScanRequired - [FullScanSigVersion](#healthfullscansigversion)
------ FullScanSigVersion - [FullScanTime](#healthfullscantime)
------ FullScanTime - [IsVirtualMachine](#healthisvirtualmachine)
------ IsVirtualMachine - [NisEnabled](#healthnisenabled)
------ NisEnabled - [ProductStatus](#healthproductstatus)
------ ProductStatus - [QuickScanOverdue](#healthquickscanoverdue)
------ QuickScanOverdue - [QuickScanSigVersion](#healthquickscansigversion)
------ QuickScanSigVersion - [QuickScanTime](#healthquickscantime)
------ QuickScanTime - [RebootRequired](#healthrebootrequired)
------ RebootRequired - [RtpEnabled](#healthrtpenabled)
------ RtpEnabled - [SignatureOutOfDate](#healthsignatureoutofdate)
------ SignatureOutOfDate - [SignatureVersion](#healthsignatureversion)
------ SignatureVersion - [TamperProtectionEnabled](#healthtamperprotectionenabled)
------ TamperProtectionEnabled - [OfflineScan](#offlinescan)
--- OfflineScan - [RollbackEngine](#rollbackengine)
--- RollbackEngine - [RollbackPlatform](#rollbackplatform)
--- RollbackPlatform - [Scan](#scan)
--- Scan - [UpdateSignature](#updatesignature)
--- UpdateSignature
```
<!-- Defender-Tree-End --> <!-- Defender-Tree-End -->
<!-- Device-Configuration-Begin --> <!-- Device-Configuration-Begin -->
@ -633,7 +631,7 @@ Control Device Control default enforcement. This is the enforcement applied if t
<!-- Device-Configuration-DeviceControl-PolicyGroups-{GroupId}-GroupData-Description-Begin --> <!-- Device-Configuration-DeviceControl-PolicyGroups-{GroupId}-GroupData-Description-Begin -->
<!-- Description-Source-DDF --> <!-- Description-Source-DDF -->
Follow the instructions provided here: <https://learn.microsoft.com/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control> For more information, see [Microsoft Defender for Endpoint Device Control Removable Storage Access Control](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control).
<!-- Device-Configuration-DeviceControl-PolicyGroups-{GroupId}-GroupData-Description-End --> <!-- Device-Configuration-DeviceControl-PolicyGroups-{GroupId}-GroupData-Description-End -->
<!-- Device-Configuration-DeviceControl-PolicyGroups-{GroupId}-GroupData-Editable-Begin --> <!-- Device-Configuration-DeviceControl-PolicyGroups-{GroupId}-GroupData-Editable-Begin -->
@ -748,7 +746,7 @@ Follow the instructions provided here: <https://learn.microsoft.com/microsoft-36
<!-- Device-Configuration-DeviceControl-PolicyRules-{RuleId}-RuleData-Description-Begin --> <!-- Device-Configuration-DeviceControl-PolicyRules-{RuleId}-RuleData-Description-Begin -->
<!-- Description-Source-DDF --> <!-- Description-Source-DDF -->
Follow the instructions provided here: <https://learn.microsoft.com/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control> For more information, see [Microsoft Defender for Endpoint Device Control Removable Storage Access Control](/microsoft-365/security/defender-endpoint/device-control-removable-storage-access-control).
<!-- Device-Configuration-DeviceControl-PolicyRules-{RuleId}-RuleData-Description-End --> <!-- Device-Configuration-DeviceControl-PolicyRules-{RuleId}-RuleData-Description-End -->
<!-- Device-Configuration-DeviceControl-PolicyRules-{RuleId}-RuleData-Editable-Begin --> <!-- Device-Configuration-DeviceControl-PolicyRules-{RuleId}-RuleData-Editable-Begin -->
@ -1795,9 +1793,9 @@ Setting to control automatic remediation for Sense scans.
| Flag | Description | | Flag | Description |
|:--|:--| |:--|:--|
| 0x1 | | | 0x1 | PASSIVE_REMEDIATION_FLAG_SENSE_AUTO_REMEDIATION: Passive Remediation Sense AutoRemediation. |
| 0x2 | | | 0x2 | PASSIVE_REMEDIATION_FLAG_RTP_AUDIT: Passive Remediation Realtime Protection Audit. |
| 0x4 | | | 0x4 | PASSIVE_REMEDIATION_FLAG_RTP_REMEDIATION: Passive Remediation Realtime Protection Remediation. |
<!-- Device-Configuration-PassiveRemediation-AllowedValues-End --> <!-- Device-Configuration-PassiveRemediation-AllowedValues-End -->
<!-- Device-Configuration-PassiveRemediation-Examples-Begin --> <!-- Device-Configuration-PassiveRemediation-Examples-Begin -->

86
windows/client-management/mdm/diagnosticlog-csp.md
View File

@ -4,7 +4,7 @@ description: Learn more about the DiagnosticLog CSP.
author: vinaypamnani-msft author: vinaypamnani-msft
manager: aaroncz manager: aaroncz
ms.author: vinpa ms.author: vinpa
ms.date: 02/21/2023 ms.date: 02/28/2023
ms.localizationpriority: medium ms.localizationpriority: medium
ms.prod: windows-client ms.prod: windows-client
ms.technology: itpro-manage ms.technology: itpro-manage
@ -21,49 +21,47 @@ ms.topic: reference
<!-- DiagnosticLog-Editable-End --> <!-- DiagnosticLog-Editable-End -->
<!-- DiagnosticLog-Tree-Begin --> <!-- DiagnosticLog-Tree-Begin -->
The following example shows the DiagnosticLog configuration service provider in tree format. The following list shows the DiagnosticLog configuration service provider nodes:
```text - ./Vendor/MSFT/DiagnosticLog
./Vendor/MSFT/DiagnosticLog - [DeviceStateData](#devicestatedata)
--- DeviceStateData - [MdmConfiguration](#devicestatedatamdmconfiguration)
------ MdmConfiguration - [DiagnosticArchive](#diagnosticarchive)
--- DiagnosticArchive - [ArchiveDefinition](#diagnosticarchivearchivedefinition)
------ ArchiveDefinition - [ArchiveResults](#diagnosticarchivearchiveresults)
------ ArchiveResults - [EtwLog](#etwlog)
--- EtwLog - [Channels](#etwlogchannels)
------ Channels - [{ChannelName}](#etwlogchannelschannelname)
--------- {ChannelName} - [Export](#etwlogchannelschannelnameexport)
------------ Export - [Filter](#etwlogchannelschannelnamefilter)
------------ Filter - [State](#etwlogchannelschannelnamestate)
------------ State - [Collectors](#etwlogcollectors)
------ Collectors - [{CollectorName}](#etwlogcollectorscollectorname)
--------- {CollectorName} - [LogFileSizeLimitMB](#etwlogcollectorscollectornamelogfilesizelimitmb)
------------ LogFileSizeLimitMB - [Providers](#etwlogcollectorscollectornameproviders)
------------ Providers - [{ProviderGuid}](#etwlogcollectorscollectornameprovidersproviderguid)
--------------- {ProviderGuid} - [Keywords](#etwlogcollectorscollectornameprovidersproviderguidkeywords)
------------------ Keywords - [State](#etwlogcollectorscollectornameprovidersproviderguidstate)
------------------ State - [TraceLevel](#etwlogcollectorscollectornameprovidersproviderguidtracelevel)
------------------ TraceLevel - [TraceControl](#etwlogcollectorscollectornametracecontrol)
------------ TraceControl - [TraceLogFileMode](#etwlogcollectorscollectornametracelogfilemode)
------------ TraceLogFileMode - [TraceStatus](#etwlogcollectorscollectornametracestatus)
------------ TraceStatus - [FileDownload](#filedownload)
--- FileDownload - [DMChannel](#filedownloaddmchannel)
------ DMChannel - [{FileContext}](#filedownloaddmchannelfilecontext)
--------- {FileContext} - [BlockCount](#filedownloaddmchannelfilecontextblockcount)
------------ BlockCount - [BlockData](#filedownloaddmchannelfilecontextblockdata)
------------ BlockData - [BlockIndexToRead](#filedownloaddmchannelfilecontextblockindextoread)
------------ BlockIndexToRead - [BlockSizeKB](#filedownloaddmchannelfilecontextblocksizekb)
------------ BlockSizeKB - [DataBlocks](#filedownloaddmchannelfilecontextdatablocks)
------------ DataBlocks - [{BlockNumber}](#filedownloaddmchannelfilecontextdatablocksblocknumber)
--------------- {BlockNumber} - [Policy](#policy)
--- Policy - [Channels](#policychannels)
------ Channels - [{ChannelName}](#policychannelschannelname)
--------- {ChannelName} - [ActionWhenFull](#policychannelschannelnameactionwhenfull)
------------ ActionWhenFull - [Enabled](#policychannelschannelnameenabled)
------------ Enabled - [MaximumFileSize](#policychannelschannelnamemaximumfilesize)
------------ MaximumFileSize - [SDDL](#policychannelschannelnamesddl)
------------ SDDL
```
<!-- DiagnosticLog-Tree-End --> <!-- DiagnosticLog-Tree-End -->
<!-- Device-DeviceStateData-Begin --> <!-- Device-DeviceStateData-Begin -->
@ -2659,7 +2657,7 @@ Maximum size of the channel log file in MB.
<!-- Device-Policy-Channels-{ChannelName}-SDDL-Description-Begin --> <!-- Device-Policy-Channels-{ChannelName}-SDDL-Description-Begin -->
<!-- Description-Source-DDF --> <!-- Description-Source-DDF -->
SDDL String controlling access to the channel. Default: <https://docs.microsoft.com/windows/desktop/WES/eventmanifestschema-channeltype-complextype> SDDL String controlling access to the channel. For more information, see [ChannelType Complex Type](/windows/win32/wes/eventmanifestschema-channeltype-complextype).
<!-- Device-Policy-Channels-{ChannelName}-SDDL-Description-End --> <!-- Device-Policy-Channels-{ChannelName}-SDDL-Description-End -->
<!-- Device-Policy-Channels-{ChannelName}-SDDL-Editable-Begin --> <!-- Device-Policy-Channels-{ChannelName}-SDDL-Editable-Begin -->

119
windows/client-management/mdm/eap-configuration.md
View File

@ -1,7 +1,7 @@
--- ---
title: EAP configuration title: EAP configuration
description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including details about EAP certificate filtering in Windows 10. description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, including details about EAP certificate filtering in Windows 10.
ms.reviewer: ms.reviewer:
manager: aaroncz manager: aaroncz
ms.author: vinpa ms.author: vinpa
ms.topic: article ms.topic: article
@ -19,45 +19,45 @@ This article provides a step-by-step guide for creating an Extensible Authentica
To get the EAP configuration from your desktop using the rasphone tool that is shipped in the box: To get the EAP configuration from your desktop using the rasphone tool that is shipped in the box:
1. Run rasphone.exe. 1. Run rasphone.exe.
![vpnv2 rasphone.](images/vpnv2-csp-rasphone.png) ![vpnv2 rasphone.](images/vpnv2-csp-rasphone.png)
1. If you don't currently have a VPN connection and you see the following message, select **OK**. 1. If you don't currently have a VPN connection and you see the following message, select **OK**.
![vpnv2 csp network connections.](images/vpnv2-csp-networkconnections.png) ![vpnv2 csp network connections.](images/vpnv2-csp-networkconnections.png)
1. In the wizard, select **Workplace network**. 1. In the wizard, select **Workplace network**.
![vpnv2 csp set up connection.](images/vpnv2-csp-setupnewconnection.png) ![vpnv2 csp set up connection.](images/vpnv2-csp-setupnewconnection.png)
1. Enter an Internet address and connection name. These details can be fake since it doesn't impact the authentication parameters. 1. Enter an Internet address and connection name. These details can be fake since it doesn't impact the authentication parameters.
![vpnv2 csp set up connection 2.](images/vpnv2-csp-setupnewconnection2.png) ![vpnv2 csp set up connection 2.](images/vpnv2-csp-setupnewconnection2.png)
1. Create a fake VPN connection. In the UI shown here, select **Properties**. 1. Create a fake VPN connection. In the UI shown here, select **Properties**.
![vpnv2 csp choose nw connection.](images/vpnv2-csp-choosenetworkconnection.png) ![vpnv2 csp choose nw connection.](images/vpnv2-csp-choosenetworkconnection.png)
1. In the **Test Properties** dialog, select the **Security** tab. 1. In the **Test Properties** dialog, select the **Security** tab.
![vpnv2 csp test props.](images/vpnv2-csp-testproperties.png) ![vpnv2 csp test props.](images/vpnv2-csp-testproperties.png)
1. On the **Security** tab, select **Use Extensible Authentication Protocol (EAP)**. 1. On the **Security** tab, select **Use Extensible Authentication Protocol (EAP)**.
![vpnv2 csp test props2.](images/vpnv2-csp-testproperties2.png) ![vpnv2 csp test props2.](images/vpnv2-csp-testproperties2.png)
1. From the drop-down menu, select the EAP method that you want to configure, and then select **Properties** to configure as needed. 1. From the drop-down menu, select the EAP method that you want to configure, and then select **Properties** to configure as needed.
![vpnv2 csp test props3.](images/vpnv2-csp-testproperties3.png)![vpnv2 csp test props4](images/vpnv2-csp-testproperties4.png) ![vpnv2 csp test props3.](images/vpnv2-csp-testproperties3.png)![vpnv2 csp test props4](images/vpnv2-csp-testproperties4.png)
1. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML. 1. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML.
```powershell ```powershell
Get-VpnConnection -Name Test Get-VpnConnection -Name Test
``` ```
<a href="" id="pow"></a>Here's an example output. Here's an example output.
``` syntax ``` syntax
Name : Test Name : Test
@ -88,26 +88,46 @@ To get the EAP configuration from your desktop using the rasphone tool that is s
Here's an example output. Here's an example output.
```xml ```xml
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.co <EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
m/provisioning/EapCommon">13</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorTy <EapMethod>
pe xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisi <Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type>
oning/EapCommon">0</AuthorId></EapMethod><Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><Eap xmlns="h <VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId>
ttp://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>13</Type><EapType xmlns="http://www.microsoft.co <VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType>
m/provisioning/EapTlsConnectionPropertiesV1"><CredentialsSource><CertificateStore><SimpleCertSelection>true</SimpleCertSel <AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId>
ection></CertificateStore></CredentialsSource><ServerValidation><DisableUserPromptForServerValidation>false</DisableUserPr </EapMethod>
omptForServerValidation><ServerNames></ServerNames></ServerValidation><DifferentUsername>false</DifferentUsername><Perform <Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
ServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</PerformServerValidation> <Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1">
<AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</AcceptServerName><TLSEx <Type>13</Type>
tensions xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2"><FilteringInfo xmlns="http://www.micro <EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1">
soft.com/provisioning/EapTlsConnectionPropertiesV3"><ClientAuthEKUList Enabled="true" /><AnyPurposeEKUList Enabled="true" <CredentialsSource>
/></FilteringInfo></TLSExtensions></EapType></Eap></Config></EapHostConfig> <CertificateStore>
<SimpleCertSelection>true</SimpleCertSelection>
</CertificateStore>
</CredentialsSource>
<ServerValidation>
<DisableUserPromptForServerValidation>false</DisableUserPromptForServerValidation>
<ServerNames />
</ServerValidation>
<DifferentUsername>false</DifferentUsername>
<PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</PerformServerValidation>
<AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</AcceptServerName>
<TLSExtensions xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">
<FilteringInfo xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV3">
<ClientAuthEKUList Enabled="true" />
<AnyPurposeEKUList Enabled="true" />
</FilteringInfo>
</TLSExtensions>
</EapType>
</Eap>
</Config>
</EapHostConfig>
``` ```
> [!NOTE] > [!NOTE]
> You should check with Mobile Device Management (MDM) vendor, if you need to pass this XML in escaped format. The XSDs for all EAP methods are shipped in the box and can be found at the following locations: > You should check with Mobile Device Management (MDM) vendor, if you need to pass this XML in escaped format. The XSDs for all EAP methods are shipped in the box and can be found at the following locations:
> - C:\\Windows\\schemas\\EAPHost >
> - C:\\Windows\\schemas\\EAPMethods > - C:\\Windows\\schemas\\EAPHost
> - C:\\Windows\\schemas\\EAPMethods
## EAP certificate filtering ## EAP certificate filtering
@ -115,15 +135,15 @@ In your deployment, if you have multiple certificates provisioned on the device
Enterprises deploying certificate-based EAP authentication for VPN and Wi-Fi can encounter a situation where there are multiple certificates that meet the default criteria for authentication. This situation can lead to issues such as: Enterprises deploying certificate-based EAP authentication for VPN and Wi-Fi can encounter a situation where there are multiple certificates that meet the default criteria for authentication. This situation can lead to issues such as:
- The user might be prompted to select the certificate. - The user might be prompted to select the certificate.
- The wrong certificate might be auto-selected and cause an authentication failure. - The wrong certificate might be auto-selected and cause an authentication failure.
A production ready deployment must have appropriate certificate details as part of the profile being deployed. The following information explains how to create or update an EAP configuration XML such that the extraneous certificates are filtered out and appropriate certificate can be used for the authentication. A production ready deployment must have appropriate certificate details as part of the profile being deployed. The following information explains how to create or update an EAP configuration XML such that the extraneous certificates are filtered out and appropriate certificate can be used for the authentication.
EAP XML must be updated with relevant information for your environment. This task can be done manually by editing the following XML sample or by using the step-by-step UI guide. After the EAP XML is updated, refer to instructions from your MDM to deploy the updated configuration as follows: EAP XML must be updated with relevant information for your environment. This task can be done manually by editing the following XML sample or by using the step-by-step UI guide. After the EAP XML is updated, refer to instructions from your MDM to deploy the updated configuration as follows:
- For Wi-Fi, look for the `<EAPConfig>` section of your current WLAN Profile XML. (This section is what you specify for the WLanXml node in the Wi-Fi CSP.) Within these tags, you'll find the complete EAP configuration. Replace the section under `<EAPConfig>` with your updated XML and update your Wi-Fi profile. You can refer to your MDM’s guidance on how to deploy a new Wi-Fi profile. - For Wi-Fi, look for the `<EAPConfig>` section of your current WLAN Profile XML. (This section is what you specify for the WLanXml node in the Wi-Fi CSP.) Within these tags, you'll find the complete EAP configuration. Replace the section under `<EAPConfig>` with your updated XML and update your Wi-Fi profile. You can refer to your MDM’s guidance on how to deploy a new Wi-Fi profile.
- For VPN, EAP configuration is a separate field in the MDM configuration. Work with your MDM provider to identify and update the appropriate field. - For VPN, EAP configuration is a separate field in the MDM configuration. Work with your MDM provider to identify and update the appropriate field.
For information about EAP settings, see <https://technet.microsoft.com/library/hh945104.aspx#BKMK_Cfg_cert_Selct>. For information about EAP settings, see <https://technet.microsoft.com/library/hh945104.aspx#BKMK_Cfg_cert_Selct>.
@ -135,23 +155,22 @@ For information about adding EKU to a certificate, see <https://technet.microsof
The following list describes the prerequisites for a certificate to be used with EAP: The following list describes the prerequisites for a certificate to be used with EAP:
- The certificate must have at least one of the following EKU properties: - The certificate must have at least one of the following EKU properties:
- Client Authentication: As defined by RFC 5280, this property is a well-defined OID with value 1.3.6.1.5.5.7.3.2. - Client Authentication: As defined by RFC 5280, this property is a well-defined OID with value 1.3.6.1.5.5.7.3.2.
- Any Purpose: This property is an EKU-defined one and is published by Microsoft. It is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that other non-critical or custom EKUs can still be added to the certificate for effective filtering. - Any Purpose: This property is an EKU-defined one and is published by Microsoft. It is a well-defined OID with value 1.3.6.1.4.1.311.10.12.1. The inclusion of this OID implies that the certificate can be used for any purpose. The advantage of this EKU over the All Purpose EKU is that other non-critical or custom EKUs can still be added to the certificate for effective filtering.
- All Purpose: As defined by RFC 5280, if a CA includes EKUs to satisfy some application needs, but doesn't want to restrict usage of the key, the CA can add an EKU value of 0. A certificate with such an EKU can be used for all purposes. - All Purpose: As defined by RFC 5280, if a CA includes EKUs to satisfy some application needs, but doesn't want to restrict usage of the key, the CA can add an EKU value of 0. A certificate with such an EKU can be used for all purposes.
- The user or the computer certificate on the client must chain to a trusted root CA. - The user or the computer certificate on the client must chain to a trusted root CA.
- The user or the computer certificate doesn't fail any one of the checks that are performed by the CryptoAPI certificate store, and the certificate passes requirements in the remote access policy. - The user or the computer certificate doesn't fail any one of the checks that are performed by the CryptoAPI certificate store, and the certificate passes requirements in the remote access policy.
- The user or the computer certificate doesn't fail any one of the certificate object identifier checks that are specified in the Internet Authentication Service (IAS)/Radius Server. - The user or the computer certificate doesn't fail any one of the certificate object identifier checks that are specified in the Internet Authentication Service (IAS)/Radius Server.
- The Subject Alternative Name (SubjectAltName) extension in the certificate contains the user principal name (UPN) of the user. - The Subject Alternative Name (SubjectAltName) extension in the certificate contains the user principal name (UPN) of the user.
The following XML sample explains the properties for the EAP TLS XML, including certificate filtering. The following XML sample explains the properties for the EAP TLS XML, including certificate filtering.
> [!NOTE] > [!NOTE]
> For PEAP or TTLS profiles, the EAP TLS XML is embedded within some PEAP-specific or TTLS-specific elements. > For PEAP or TTLS profiles, the EAP TLS XML is embedded within some PEAP-specific or TTLS-specific elements.
 
```xml ```xml
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"> <EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
<EapMethod> <EapMethod>
@ -254,36 +273,32 @@ The following XML sample explains the properties for the EAP TLS XML, including
> [!NOTE] > [!NOTE]
> The EAP TLS XSD is located at %systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd. > The EAP TLS XSD is located at %systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd.
 
Alternatively, you can use the following procedure to create an EAP configuration XML: Alternatively, you can use the following procedure to create an EAP configuration XML:
1. Follow steps 1 through 7 in the EAP configuration article. 1. Follow steps 1 through 7 in the EAP configuration article.
1. In the **Microsoft VPN SelfHost Properties** dialog box, select **Microsoft: Smart Card or other Certificate** from the drop-down menu (this value selects EAP TLS). 1. In the **Microsoft VPN SelfHost Properties** dialog box, select **Microsoft: Smart Card or other Certificate** from the drop-down menu (this value selects EAP TLS).
![vpn self host properties window.](images/certfiltering1.png) ![vpn self host properties window.](images/certfiltering1.png)
> [!NOTE] > [!NOTE]
> For PEAP or TTLS, select the appropriate method and continue following this procedure. > For PEAP or TTLS, select the appropriate method and continue following this procedure.
  1. Select the **Properties** button underneath the drop-down menu.
1. On the **Smart Card or other Certificate Properties** menu, select the **Advanced** button.
1. Select the **Properties** button underneath the drop-down menu.
1. On the **Smart Card or other Certificate Properties** menu, select the **Advanced** button.
![smart card or other certificate properties window.](images/certfiltering2.png) ![smart card or other certificate properties window.](images/certfiltering2.png)
1. On the **Configure Certificate Selection** menu, adjust the filters as needed. 1. On the **Configure Certificate Selection** menu, adjust the filters as needed.
![configure certificate window.](images/certfiltering3.png) ![configure certificate window.](images/certfiltering3.png)
1. Select **OK** to close the windows and get back to the main rasphone.exe dialog box. 1. Select **OK** to close the windows and get back to the main rasphone.exe dialog box.
1. Close the rasphone dialog box. 1. Close the rasphone dialog box.
1. Continue following the procedure in the EAP configuration article from step 9 to get an EAP TLS profile with appropriate filtering. 1. Continue following the procedure in the EAP configuration article from step 9 to get an EAP TLS profile with appropriate filtering.
> [!NOTE] > [!NOTE]
> You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) Settings for Network Access](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11)) article. > You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) Settings for Network Access](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh945104(v=ws.11)) article.
## Related topics ## Related topics
[Configuration service provider reference](index.yml) [Configuration service provider reference](index.yml)

136
windows/client-management/mdm/surfacehub-csp.md
View File

@ -4,7 +4,7 @@ description: Learn more about the SurfaceHub CSP.
author: vinaypamnani-msft author: vinaypamnani-msft
manager: aaroncz manager: aaroncz
ms.author: vinpa ms.author: vinpa
ms.date: 02/24/2023 ms.date: 02/28/2023
ms.localizationpriority: medium ms.localizationpriority: medium
ms.prod: windows-client ms.prod: windows-client
ms.technology: itpro-manage ms.technology: itpro-manage
@ -25,74 +25,72 @@ The SurfaceHub configuration service provider (CSP) is used to configure Microso
<!-- SurfaceHub-Editable-End --> <!-- SurfaceHub-Editable-End -->
<!-- SurfaceHub-Tree-Begin --> <!-- SurfaceHub-Tree-Begin -->
The following example shows the SurfaceHub configuration service provider in tree format. The following list shows the SurfaceHub configuration service provider nodes:
```text - ./Vendor/MSFT/SurfaceHub
./Vendor/MSFT/SurfaceHub - [AutopilotSelfdeploy](#autopilotselfdeploy)
--- AutopilotSelfdeploy - [FriendlyName](#autopilotselfdeployfriendlyname)
------ FriendlyName - [Password](#autopilotselfdeploypassword)
------ Password - [UserPrincipalName](#autopilotselfdeployuserprincipalname)
------ UserPrincipalName - [DeviceAccount](#deviceaccount)
--- DeviceAccount - [CalendarSyncEnabled](#deviceaccountcalendarsyncenabled)
------ CalendarSyncEnabled - [DomainName](#deviceaccountdomainname)
------ DomainName - [Email](#deviceaccountemail)
------ Email - [ErrorContext](#deviceaccounterrorcontext)
------ ErrorContext - [ExchangeModernAuthEnabled](#deviceaccountexchangemodernauthenabled)
------ ExchangeModernAuthEnabled - [ExchangeServer](#deviceaccountexchangeserver)
------ ExchangeServer - [Password](#deviceaccountpassword)
------ Password - [PasswordRotationPeriod](#deviceaccountpasswordrotationperiod)
------ PasswordRotationPeriod - [SipAddress](#deviceaccountsipaddress)
------ SipAddress - [UserName](#deviceaccountusername)
------ UserName - [UserPrincipalName](#deviceaccountuserprincipalname)
------ UserPrincipalName - [ValidateAndCommit](#deviceaccountvalidateandcommit)
------ ValidateAndCommit - [Dot3](#dot3)
--- Dot3 - [EapUserData](#dot3eapuserdata)
------ EapUserData - [LanProfile](#dot3lanprofile)
------ LanProfile - [InBoxApps](#inboxapps)
--- InBoxApps - [Connect](#inboxappsconnect)
------ Connect - [AutoLaunch](#inboxappsconnectautolaunch)
--------- AutoLaunch - [SkypeForBusiness](#inboxappsskypeforbusiness)
------ SkypeForBusiness - [DomainName](#inboxappsskypeforbusinessdomainname)
--------- DomainName - [Teams](#inboxappsteams)
------ Teams - [Configurations](#inboxappsteamsconfigurations)
--------- Configurations - [Welcome](#inboxappswelcome)
------ Welcome - [AutoWakeScreen](#inboxappswelcomeautowakescreen)
--------- AutoWakeScreen - [CurrentBackgroundPath](#inboxappswelcomecurrentbackgroundpath)
--------- CurrentBackgroundPath - [MeetingInfoOption](#inboxappswelcomemeetinginfooption)
--------- MeetingInfoOption - [Whiteboard](#inboxappswhiteboard)
------ Whiteboard - [SharingDisabled](#inboxappswhiteboardsharingdisabled)
--------- SharingDisabled - [SignInDisabled](#inboxappswhiteboardsignindisabled)
--------- SignInDisabled - [TelemetryDisabled](#inboxappswhiteboardtelemetrydisabled)
--------- TelemetryDisabled - [WirelessProjection](#inboxappswirelessprojection)
------ WirelessProjection - [Channel](#inboxappswirelessprojectionchannel)
--------- Channel - [Enabled](#inboxappswirelessprojectionenabled)
--------- Enabled - [PINRequired](#inboxappswirelessprojectionpinrequired)
--------- PINRequired - [MaintenanceHoursSimple](#maintenancehourssimple)
--- MaintenanceHoursSimple - [Hours](#maintenancehourssimplehours)
------ Hours - [Duration](#maintenancehourssimplehoursduration)
--------- Duration - [StartTime](#maintenancehourssimplehoursstarttime)
--------- StartTime - [Management](#management)
--- Management - [GroupName](#managementgroupname)
------ GroupName - [GroupSid](#managementgroupsid)
------ GroupSid - [MOMAgent](#momagent)
--- MOMAgent - [WorkspaceID](#momagentworkspaceid)
------ WorkspaceID - [WorkspaceKey](#momagentworkspacekey)
------ WorkspaceKey - [Properties](#properties)
--- Properties - [AllowAutoProxyAuth](#propertiesallowautoproxyauth)
------ AllowAutoProxyAuth - [AllowSessionResume](#propertiesallowsessionresume)
------ AllowSessionResume - [DefaultVolume](#propertiesdefaultvolume)
------ DefaultVolume - [DisableSigninSuggestions](#propertiesdisablesigninsuggestions)
------ DisableSigninSuggestions - [DoNotShowMyMeetingsAndFiles](#propertiesdonotshowmymeetingsandfiles)
------ DoNotShowMyMeetingsAndFiles - [FriendlyName](#propertiesfriendlyname)
------ FriendlyName - [ProxyServers](#propertiesproxyservers)
------ ProxyServers - [ScreenTimeout](#propertiesscreentimeout)
------ ScreenTimeout - [SessionTimeout](#propertiessessiontimeout)
------ SessionTimeout - [SleepMode](#propertiessleepmode)
------ SleepMode - [SleepTimeout](#propertiessleeptimeout)
------ SleepTimeout - [SurfaceHubMeetingMode](#propertiessurfacehubmeetingmode)
------ SurfaceHubMeetingMode - [VtcAppPackageId](#propertiesvtcapppackageid)
------ VtcAppPackageId
```
<!-- SurfaceHub-Tree-End --> <!-- SurfaceHub-Tree-End -->
<!-- Device-AutopilotSelfdeploy-Begin --> <!-- Device-AutopilotSelfdeploy-Begin -->
@ -1148,7 +1146,7 @@ Node for the Skype for Business settings.
<!-- Device-InBoxApps-SkypeForBusiness-DomainName-Description-Begin --> <!-- Device-InBoxApps-SkypeForBusiness-DomainName-Description-Begin -->
<!-- Description-Source-DDF --> <!-- Description-Source-DDF -->
Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see <https://docs.microsoft.com/SkypeForBusiness/set-up-skype-for-business-online/set-up-skype-for-business-online?redirectSourcePath=%252fen-us%252farticle%252fSet-up-Skype-for-Business-Online-40296968-e779-4259-980b-c2de1c044c6e#bkmk_users> Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see [Set up your domain and users](/skypeforbusiness/set-up-skype-for-business-online/set-up-skype-for-business-online#3-set-up-your-domain-and-users).
<!-- Device-InBoxApps-SkypeForBusiness-DomainName-Description-End --> <!-- Device-InBoxApps-SkypeForBusiness-DomainName-Description-End -->
<!-- Device-InBoxApps-SkypeForBusiness-DomainName-Editable-Begin --> <!-- Device-InBoxApps-SkypeForBusiness-DomainName-Editable-Begin -->

418
windows/client-management/mdm/vpnv2-csp.md
View File

@ -4,7 +4,7 @@ description: Learn more about the VPNv2 CSP.
author: vinaypamnani-msft author: vinaypamnani-msft
manager: aaroncz manager: aaroncz
ms.author: vinpa ms.author: vinpa
ms.date: 02/27/2023 ms.date: 02/28/2023
ms.localizationpriority: medium ms.localizationpriority: medium
ms.prod: windows-client ms.prod: windows-client
ms.technology: itpro-manage ms.technology: itpro-manage
@ -36,214 +36,212 @@ The XSDs for all EAP methods are shipped in the box and can be found at the foll
<!-- VPNv2-Editable-End --> <!-- VPNv2-Editable-End -->
<!-- VPNv2-Tree-Begin --> <!-- VPNv2-Tree-Begin -->
The following example shows the VPNv2 configuration service provider in tree format. The following list shows the VPNv2 configuration service provider nodes:
```text - ./Device/Vendor/MSFT/VPNv2
./Device/Vendor/MSFT/VPNv2 - [{ProfileName}](#deviceprofilename)
--- {ProfileName} - [AlwaysOn](#deviceprofilenamealwayson)
------ AlwaysOn - [AlwaysOnActive](#deviceprofilenamealwaysonactive)
------ AlwaysOnActive - [APNBinding](#deviceprofilenameapnbinding)
------ APNBinding - [AccessPointName](#deviceprofilenameapnbindingaccesspointname)
--------- AccessPointName - [AuthenticationType](#deviceprofilenameapnbindingauthenticationtype)
--------- AuthenticationType - [IsCompressionEnabled](#deviceprofilenameapnbindingiscompressionenabled)
--------- IsCompressionEnabled - [Password](#deviceprofilenameapnbindingpassword)
--------- Password - [ProviderId](#deviceprofilenameapnbindingproviderid)
--------- ProviderId - [UserName](#deviceprofilenameapnbindingusername)
--------- UserName - [AppTriggerList](#deviceprofilenameapptriggerlist)
------ AppTriggerList - [{appTriggerRowId}](#deviceprofilenameapptriggerlistapptriggerrowid)
--------- {appTriggerRowId} - [App](#deviceprofilenameapptriggerlistapptriggerrowidapp)
------------ App - [Id](#deviceprofilenameapptriggerlistapptriggerrowidappid)
--------------- Id - [Type](#deviceprofilenameapptriggerlistapptriggerrowidapptype)
--------------- Type - [ByPassForLocal](#deviceprofilenamebypassforlocal)
------ ByPassForLocal - [DataEncryption](#deviceprofilenamedataencryption)
------ DataEncryption - [DeviceCompliance](#deviceprofilenamedevicecompliance)
------ DeviceCompliance - [Enabled](#deviceprofilenamedevicecomplianceenabled)
--------- Enabled - [Sso](#deviceprofilenamedevicecompliancesso)
--------- Sso - [Eku](#deviceprofilenamedevicecompliancessoeku)
------------ Eku - [Enabled](#deviceprofilenamedevicecompliancessoenabled)
------------ Enabled - [IssuerHash](#deviceprofilenamedevicecompliancessoissuerhash)
------------ IssuerHash - [DeviceTunnel](#deviceprofilenamedevicetunnel)
------ DeviceTunnel - [DisableAdvancedOptionsEditButton](#deviceprofilenamedisableadvancedoptionseditbutton)
------ DisableAdvancedOptionsEditButton - [DisableDisconnectButton](#deviceprofilenamedisabledisconnectbutton)
------ DisableDisconnectButton - [DisableIKEv2Fragmentation](#deviceprofilenamedisableikev2fragmentation)
------ DisableIKEv2Fragmentation - [DnsSuffix](#deviceprofilenamednssuffix)
------ DnsSuffix - [DomainNameInformationList](#deviceprofilenamedomainnameinformationlist)
------ DomainNameInformationList - [{dniRowId}](#deviceprofilenamedomainnameinformationlistdnirowid)
--------- {dniRowId} - [AutoTrigger](#deviceprofilenamedomainnameinformationlistdnirowidautotrigger)
------------ AutoTrigger - [DnsServers](#deviceprofilenamedomainnameinformationlistdnirowiddnsservers)
------------ DnsServers - [DomainName](#deviceprofilenamedomainnameinformationlistdnirowiddomainname)
------------ DomainName - [DomainNameType](#deviceprofilenamedomainnameinformationlistdnirowiddomainnametype)
------------ DomainNameType - [Persistent](#deviceprofilenamedomainnameinformationlistdnirowidpersistent)
------------ Persistent - [WebProxyServers](#deviceprofilenamedomainnameinformationlistdnirowidwebproxyservers)
------------ WebProxyServers - [EdpModeId](#deviceprofilenameedpmodeid)
------ EdpModeId - [IPv4InterfaceMetric](#deviceprofilenameipv4interfacemetric)
------ IPv4InterfaceMetric - [IPv6InterfaceMetric](#deviceprofilenameipv6interfacemetric)
------ IPv6InterfaceMetric - [NativeProfile](#deviceprofilenamenativeprofile)
------ NativeProfile - [Authentication](#deviceprofilenamenativeprofileauthentication)
--------- Authentication - [Certificate](#deviceprofilenamenativeprofileauthenticationcertificate)
------------ Certificate - [Eku](#deviceprofilenamenativeprofileauthenticationcertificateeku)
--------------- Eku - [Issuer](#deviceprofilenamenativeprofileauthenticationcertificateissuer)
--------------- Issuer - [Eap](#deviceprofilenamenativeprofileauthenticationeap)
------------ Eap - [Configuration](#deviceprofilenamenativeprofileauthenticationeapconfiguration)
--------------- Configuration - [Type](#deviceprofilenamenativeprofileauthenticationeaptype)
--------------- Type - [MachineMethod](#deviceprofilenamenativeprofileauthenticationmachinemethod)
------------ MachineMethod - [UserMethod](#deviceprofilenamenativeprofileauthenticationusermethod)
------------ UserMethod - [CryptographySuite](#deviceprofilenamenativeprofilecryptographysuite)
--------- CryptographySuite - [AuthenticationTransformConstants](#deviceprofilenamenativeprofilecryptographysuiteauthenticationtransformconstants)
------------ AuthenticationTransformConstants - [CipherTransformConstants](#deviceprofilenamenativeprofilecryptographysuiteciphertransformconstants)
------------ CipherTransformConstants - [DHGroup](#deviceprofilenamenativeprofilecryptographysuitedhgroup)
------------ DHGroup - [EncryptionMethod](#deviceprofilenamenativeprofilecryptographysuiteencryptionmethod)
------------ EncryptionMethod - [IntegrityCheckMethod](#deviceprofilenamenativeprofilecryptographysuiteintegritycheckmethod)
------------ IntegrityCheckMethod - [PfsGroup](#deviceprofilenamenativeprofilecryptographysuitepfsgroup)
------------ PfsGroup - [DisableClassBasedDefaultRoute](#deviceprofilenamenativeprofiledisableclassbaseddefaultroute)
--------- DisableClassBasedDefaultRoute - [L2tpPsk](#deviceprofilenamenativeprofilel2tppsk)
--------- L2tpPsk - [NativeProtocolType](#deviceprofilenamenativeprofilenativeprotocoltype)
--------- NativeProtocolType - [PlumbIKEv2TSAsRoutes](#deviceprofilenamenativeprofileplumbikev2tsasroutes)
--------- PlumbIKEv2TSAsRoutes - [ProtocolList](#deviceprofilenamenativeprofileprotocollist)
--------- ProtocolList - [NativeProtocolList](#deviceprofilenamenativeprofileprotocollistnativeprotocollist)
------------ NativeProtocolList - [{NativeProtocolRowId}](#deviceprofilenamenativeprofileprotocollistnativeprotocollistnativeprotocolrowid)
--------------- {NativeProtocolRowId} - [Type](#deviceprofilenamenativeprofileprotocollistnativeprotocollistnativeprotocolrowidtype)
------------------ Type - [RetryTimeInHours](#deviceprofilenamenativeprofileprotocollistretrytimeinhours)
------------ RetryTimeInHours - [RoutingPolicyType](#deviceprofilenamenativeprofileroutingpolicytype)
--------- RoutingPolicyType - [Servers](#deviceprofilenamenativeprofileservers)
--------- Servers - [NetworkOutageTime](#deviceprofilenamenetworkoutagetime)
------ NetworkOutageTime - [PluginProfile](#deviceprofilenamepluginprofile)
------ PluginProfile - [CustomConfiguration](#deviceprofilenamepluginprofilecustomconfiguration)
--------- CustomConfiguration - [PluginPackageFamilyName](#deviceprofilenamepluginprofilepluginpackagefamilyname)
--------- PluginPackageFamilyName - [ServerUrlList](#deviceprofilenamepluginprofileserverurllist)
--------- ServerUrlList - [PrivateNetwork](#deviceprofilenameprivatenetwork)
------ PrivateNetwork - [ProfileXML](#deviceprofilenameprofilexml)
------ ProfileXML - [Proxy](#deviceprofilenameproxy)
------ Proxy - [AutoConfigUrl](#deviceprofilenameproxyautoconfigurl)
--------- AutoConfigUrl - [Manual](#deviceprofilenameproxymanual)
--------- Manual - [Server](#deviceprofilenameproxymanualserver)
------------ Server - [RegisterDNS](#deviceprofilenameregisterdns)
------ RegisterDNS - [RememberCredentials](#deviceprofilenameremembercredentials)
------ RememberCredentials - [RouteList](#deviceprofilenameroutelist)
------ RouteList - [{routeRowId}](#deviceprofilenameroutelistrouterowid)
--------- {routeRowId} - [Address](#deviceprofilenameroutelistrouterowidaddress)
------------ Address - [ExclusionRoute](#deviceprofilenameroutelistrouterowidexclusionroute)
------------ ExclusionRoute - [Metric](#deviceprofilenameroutelistrouterowidmetric)
------------ Metric - [PrefixSize](#deviceprofilenameroutelistrouterowidprefixsize)
------------ PrefixSize - [TrafficFilterList](#deviceprofilenametrafficfilterlist)
------ TrafficFilterList - [{trafficFilterId}](#deviceprofilenametrafficfilterlisttrafficfilterid)
--------- {trafficFilterId} - [App](#deviceprofilenametrafficfilterlisttrafficfilteridapp)
------------ App - [Id](#deviceprofilenametrafficfilterlisttrafficfilteridappid)
--------------- Id - [Type](#deviceprofilenametrafficfilterlisttrafficfilteridapptype)
--------------- Type - [Claims](#deviceprofilenametrafficfilterlisttrafficfilteridclaims)
------------ Claims - [Direction](#deviceprofilenametrafficfilterlisttrafficfilteriddirection)
------------ Direction - [LocalAddressRanges](#deviceprofilenametrafficfilterlisttrafficfilteridlocaladdressranges)
------------ LocalAddressRanges - [LocalPortRanges](#deviceprofilenametrafficfilterlisttrafficfilteridlocalportranges)
------------ LocalPortRanges - [Protocol](#deviceprofilenametrafficfilterlisttrafficfilteridprotocol)
------------ Protocol - [RemoteAddressRanges](#deviceprofilenametrafficfilterlisttrafficfilteridremoteaddressranges)
------------ RemoteAddressRanges - [RemotePortRanges](#deviceprofilenametrafficfilterlisttrafficfilteridremoteportranges)
------------ RemotePortRanges - [RoutingPolicyType](#deviceprofilenametrafficfilterlisttrafficfilteridroutingpolicytype)
------------ RoutingPolicyType - [TrustedNetworkDetection](#deviceprofilenametrustednetworkdetection)
------ TrustedNetworkDetection - [UseRasCredentials](#deviceprofilenameuserascredentials)
------ UseRasCredentials - ./User/Vendor/MSFT/VPNv2
./User/Vendor/MSFT/VPNv2 - [{ProfileName}](#userprofilename)
--- {ProfileName} - [AlwaysOn](#userprofilenamealwayson)
------ AlwaysOn - [AlwaysOnActive](#userprofilenamealwaysonactive)
------ AlwaysOnActive - [APNBinding](#userprofilenameapnbinding)
------ APNBinding - [AccessPointName](#userprofilenameapnbindingaccesspointname)
--------- AccessPointName - [AuthenticationType](#userprofilenameapnbindingauthenticationtype)
--------- AuthenticationType - [IsCompressionEnabled](#userprofilenameapnbindingiscompressionenabled)
--------- IsCompressionEnabled - [Password](#userprofilenameapnbindingpassword)
--------- Password - [ProviderId](#userprofilenameapnbindingproviderid)
--------- ProviderId - [UserName](#userprofilenameapnbindingusername)
--------- UserName - [AppTriggerList](#userprofilenameapptriggerlist)
------ AppTriggerList - [{appTriggerRowId}](#userprofilenameapptriggerlistapptriggerrowid)
--------- {appTriggerRowId} - [App](#userprofilenameapptriggerlistapptriggerrowidapp)
------------ App - [Id](#userprofilenameapptriggerlistapptriggerrowidappid)
--------------- Id - [Type](#userprofilenameapptriggerlistapptriggerrowidapptype)
--------------- Type - [ByPassForLocal](#userprofilenamebypassforlocal)
------ ByPassForLocal - [DataEncryption](#userprofilenamedataencryption)
------ DataEncryption - [DeviceCompliance](#userprofilenamedevicecompliance)
------ DeviceCompliance - [Enabled](#userprofilenamedevicecomplianceenabled)
--------- Enabled - [Sso](#userprofilenamedevicecompliancesso)
--------- Sso - [Eku](#userprofilenamedevicecompliancessoeku)
------------ Eku - [Enabled](#userprofilenamedevicecompliancessoenabled)
------------ Enabled - [IssuerHash](#userprofilenamedevicecompliancessoissuerhash)
------------ IssuerHash - [DisableAdvancedOptionsEditButton](#userprofilenamedisableadvancedoptionseditbutton)
------ DisableAdvancedOptionsEditButton - [DisableDisconnectButton](#userprofilenamedisabledisconnectbutton)
------ DisableDisconnectButton - [DisableIKEv2Fragmentation](#userprofilenamedisableikev2fragmentation)
------ DisableIKEv2Fragmentation - [DnsSuffix](#userprofilenamednssuffix)
------ DnsSuffix - [DomainNameInformationList](#userprofilenamedomainnameinformationlist)
------ DomainNameInformationList - [{dniRowId}](#userprofilenamedomainnameinformationlistdnirowid)
--------- {dniRowId} - [AutoTrigger](#userprofilenamedomainnameinformationlistdnirowidautotrigger)
------------ AutoTrigger - [DnsServers](#userprofilenamedomainnameinformationlistdnirowiddnsservers)
------------ DnsServers - [DomainName](#userprofilenamedomainnameinformationlistdnirowiddomainname)
------------ DomainName - [DomainNameType](#userprofilenamedomainnameinformationlistdnirowiddomainnametype)
------------ DomainNameType - [Persistent](#userprofilenamedomainnameinformationlistdnirowidpersistent)
------------ Persistent - [WebProxyServers](#userprofilenamedomainnameinformationlistdnirowidwebproxyservers)
------------ WebProxyServers - [EdpModeId](#userprofilenameedpmodeid)
------ EdpModeId - [IPv4InterfaceMetric](#userprofilenameipv4interfacemetric)
------ IPv4InterfaceMetric - [IPv6InterfaceMetric](#userprofilenameipv6interfacemetric)
------ IPv6InterfaceMetric - [NativeProfile](#userprofilenamenativeprofile)
------ NativeProfile - [Authentication](#userprofilenamenativeprofileauthentication)
--------- Authentication - [Certificate](#userprofilenamenativeprofileauthenticationcertificate)
------------ Certificate - [Eku](#userprofilenamenativeprofileauthenticationcertificateeku)
--------------- Eku - [Issuer](#userprofilenamenativeprofileauthenticationcertificateissuer)
--------------- Issuer - [Eap](#userprofilenamenativeprofileauthenticationeap)
------------ Eap - [Configuration](#userprofilenamenativeprofileauthenticationeapconfiguration)
--------------- Configuration - [Type](#userprofilenamenativeprofileauthenticationeaptype)
--------------- Type - [MachineMethod](#userprofilenamenativeprofileauthenticationmachinemethod)
------------ MachineMethod - [UserMethod](#userprofilenamenativeprofileauthenticationusermethod)
------------ UserMethod - [CryptographySuite](#userprofilenamenativeprofilecryptographysuite)
--------- CryptographySuite - [AuthenticationTransformConstants](#userprofilenamenativeprofilecryptographysuiteauthenticationtransformconstants)
------------ AuthenticationTransformConstants - [CipherTransformConstants](#userprofilenamenativeprofilecryptographysuiteciphertransformconstants)
------------ CipherTransformConstants - [DHGroup](#userprofilenamenativeprofilecryptographysuitedhgroup)
------------ DHGroup - [EncryptionMethod](#userprofilenamenativeprofilecryptographysuiteencryptionmethod)
------------ EncryptionMethod - [IntegrityCheckMethod](#userprofilenamenativeprofilecryptographysuiteintegritycheckmethod)
------------ IntegrityCheckMethod - [PfsGroup](#userprofilenamenativeprofilecryptographysuitepfsgroup)
------------ PfsGroup - [DisableClassBasedDefaultRoute](#userprofilenamenativeprofiledisableclassbaseddefaultroute)
--------- DisableClassBasedDefaultRoute - [L2tpPsk](#userprofilenamenativeprofilel2tppsk)
--------- L2tpPsk - [NativeProtocolType](#userprofilenamenativeprofilenativeprotocoltype)
--------- NativeProtocolType - [PlumbIKEv2TSAsRoutes](#userprofilenamenativeprofileplumbikev2tsasroutes)
--------- PlumbIKEv2TSAsRoutes - [ProtocolList](#userprofilenamenativeprofileprotocollist)
--------- ProtocolList - [NativeProtocolList](#userprofilenamenativeprofileprotocollistnativeprotocollist)
------------ NativeProtocolList - [{NativeProtocolRowId}](#userprofilenamenativeprofileprotocollistnativeprotocollistnativeprotocolrowid)
--------------- {NativeProtocolRowId} - [Type](#userprofilenamenativeprofileprotocollistnativeprotocollistnativeprotocolrowidtype)
------------------ Type - [RetryTimeInHours](#userprofilenamenativeprofileprotocollistretrytimeinhours)
------------ RetryTimeInHours - [RoutingPolicyType](#userprofilenamenativeprofileroutingpolicytype)
--------- RoutingPolicyType - [Servers](#userprofilenamenativeprofileservers)
--------- Servers - [NetworkOutageTime](#userprofilenamenetworkoutagetime)
------ NetworkOutageTime - [PluginProfile](#userprofilenamepluginprofile)
------ PluginProfile - [CustomConfiguration](#userprofilenamepluginprofilecustomconfiguration)
--------- CustomConfiguration - [PluginPackageFamilyName](#userprofilenamepluginprofilepluginpackagefamilyname)
--------- PluginPackageFamilyName - [ServerUrlList](#userprofilenamepluginprofileserverurllist)
--------- ServerUrlList - [PrivateNetwork](#userprofilenameprivatenetwork)
------ PrivateNetwork - [ProfileXML](#userprofilenameprofilexml)
------ ProfileXML - [Proxy](#userprofilenameproxy)
------ Proxy - [AutoConfigUrl](#userprofilenameproxyautoconfigurl)
--------- AutoConfigUrl - [Manual](#userprofilenameproxymanual)
--------- Manual - [Server](#userprofilenameproxymanualserver)
------------ Server - [RegisterDNS](#userprofilenameregisterdns)
------ RegisterDNS - [RememberCredentials](#userprofilenameremembercredentials)
------ RememberCredentials - [RequireVpnClientAppUI](#userprofilenamerequirevpnclientappui)
------ RequireVpnClientAppUI - [RouteList](#userprofilenameroutelist)
------ RouteList - [{routeRowId}](#userprofilenameroutelistrouterowid)
--------- {routeRowId} - [Address](#userprofilenameroutelistrouterowidaddress)
------------ Address - [ExclusionRoute](#userprofilenameroutelistrouterowidexclusionroute)
------------ ExclusionRoute - [Metric](#userprofilenameroutelistrouterowidmetric)
------------ Metric - [PrefixSize](#userprofilenameroutelistrouterowidprefixsize)
------------ PrefixSize - [TrafficFilterList](#userprofilenametrafficfilterlist)
------ TrafficFilterList - [{trafficFilterId}](#userprofilenametrafficfilterlisttrafficfilterid)
--------- {trafficFilterId} - [App](#userprofilenametrafficfilterlisttrafficfilteridapp)
------------ App - [Id](#userprofilenametrafficfilterlisttrafficfilteridappid)
--------------- Id - [Type](#userprofilenametrafficfilterlisttrafficfilteridapptype)
--------------- Type - [Claims](#userprofilenametrafficfilterlisttrafficfilteridclaims)
------------ Claims - [Direction](#userprofilenametrafficfilterlisttrafficfilteriddirection)
------------ Direction - [LocalAddressRanges](#userprofilenametrafficfilterlisttrafficfilteridlocaladdressranges)
------------ LocalAddressRanges - [LocalPortRanges](#userprofilenametrafficfilterlisttrafficfilteridlocalportranges)
------------ LocalPortRanges - [Protocol](#userprofilenametrafficfilterlisttrafficfilteridprotocol)
------------ Protocol - [RemoteAddressRanges](#userprofilenametrafficfilterlisttrafficfilteridremoteaddressranges)
------------ RemoteAddressRanges - [RemotePortRanges](#userprofilenametrafficfilterlisttrafficfilteridremoteportranges)
------------ RemotePortRanges - [RoutingPolicyType](#userprofilenametrafficfilterlisttrafficfilteridroutingpolicytype)
------------ RoutingPolicyType - [TrustedNetworkDetection](#userprofilenametrustednetworkdetection)
------ TrustedNetworkDetection - [UseRasCredentials](#userprofilenameuserascredentials)
------ UseRasCredentials
```
<!-- VPNv2-Tree-End --> <!-- VPNv2-Tree-End -->
<!-- Device-{ProfileName}-Begin --> <!-- Device-{ProfileName}-Begin -->
@ -2142,7 +2140,7 @@ Required when the native profile specifies EAP authentication. EAP configuration
<!-- Device-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Description-Begin --> <!-- Device-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Description-Begin -->
<!-- Description-Source-DDF --> <!-- Description-Source-DDF -->
HTML encoded XML of the EAP configuration. For more information about EAP configuration XML, see <https://docs.microsoft.com/windows/client-management/mdm/eap-configuration>. HTML encoded XML of the EAP configuration. For more information,see [EAP configuration](eap-configuration.md).
<!-- Device-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Description-End --> <!-- Device-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Description-End -->
<!-- Device-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Editable-Begin --> <!-- Device-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Editable-Begin -->
@ -6367,7 +6365,7 @@ Required when the native profile specifies EAP authentication. EAP configuration
<!-- User-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Description-Begin --> <!-- User-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Description-Begin -->
<!-- Description-Source-DDF --> <!-- Description-Source-DDF -->
HTML encoded XML of the EAP configuration. For more information about EAP configuration XML, see <https://docs.microsoft.com/windows/client-management/mdm/eap-configuration>. HTML encoded XML of the EAP configuration. For more information,see [EAP configuration](eap-configuration.md).
<!-- User-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Description-End --> <!-- User-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Description-End -->
<!-- User-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Editable-Begin --> <!-- User-{ProfileName}-NativeProfile-Authentication-Eap-Configuration-Editable-Begin -->